CVE-2026-107616

The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer` role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export the full CSV of attendee personally identifiable information (first/last name, email, phone, date of birth, gender, private notes, payment amounts/methods, WooCommerce order IDs, custom-field values, and uploaded-file URLs) for any Amelia event on the site by directly invoking the `/report/event/attendees` endpoint with an arbitrary event ID.

• CWE-862

• https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Application/Commands/Report/GetEventAttendeesCommandHandler.php#L49
• https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Application/Controller/Report/GetEventAttendeesController.php#L30
• https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/Routes/Report/Report.php#L40
• https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/config/Roles.php#L125
• https://wpamelia.com/documentation/changelog/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a43f7f-1314-4894-aaf1-b7ef0f3e6217?source=cve

Published

Nov 7, 2026

Last Modified

Nov 7, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107608Improper link resolution before file access in the asset bun…5.5
• CVE-2026-107611An out-of-bounds read vulnerability in the ZRLE decoder of G…7.1
• CVE-2026-107612Incorrect permission assignment in GlavSoft TightVNC Server …7.8
• CVE-2026-107613A NULL pointer dereference vulnerability in the Win8ScreenDr…5.9
• CVE-2026-107614An integer underflow in WinCursorShapeUtils::trimTransparent…6.1
• CVE-2026-107615An uncontrolled search path element vulnerability in GlavSof…7.8
• CVE-2026-107617An attacker can use a hard-coded credential to log in to Ese…9.8
• CVE-2026-107618`POST /{owner}/{repo}/topics` was registered without the sig…8.1
• CVE-2026-107621JPEGParser can enter an infinite loop while parsing a specia…7.5
• CVE-2026-107622The BuddyForms plugin for WordPress is vulnerable to Privile…9.8
• CVE-2026-107623A flaw was found in the OIDC Dynamic Client Registration (DC…4.3
• CVE-2026-107625The Ultimate Member – User Profile, Registration, Login, Mem…6.4